ClawHub
Back to skill

Security audit

video-to-shorts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local video-to-shorts workflow that writes project-scoped media/review artifacts and uses ffmpeg/Python in ways that match its purpose.

Install this only for projects where you intend an agent to process local video assets with ffmpeg/Python and create review/final outputs. Confirm /video-understand, ffmpeg/ffprobe, and Pillow are available, and use the review gates so candidate selection and vertical rendering happen only after explicit approval or clearly delegated agent approval.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to read and write project files and invoke shell commands (Python, ffmpeg, OS-native open commands), but it declares no corresponding permissions. This creates a trust and containment gap: a caller or runtime may assume the skill is low-privilege while it actually performs filesystem and command execution operations, increasing the risk of unintended file access, overwrites, or command misuse if the skill is invoked on untrusted project content or paths.

Static analysis

No suspicious patterns detected.